Bug 71377 – Assertion in FontCache::getCachedFontData() when painting into composited layer

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Simon Fraser (smfr)]

Bots show an assertion here:


Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000101730a0b WebCore::FontCache::getCachedFontData(WebCore::FontPlatformData const*, WebCore::FontCache::ShouldRetain) + 121 (FontCache.cpp:280)
1   com.apple.WebCore             	0x000000010173bb2e WebCore::FontCache::getFontDataForCharacters(WebCore::Font const&, unsigned short const*, int) + 1462 (FontCacheMac.mm:166)
2   com.apple.WebCore             	0x0000000101740f0d WebCore::Font::glyphDataAndPageForCharacter(int, bool, WebCore::FontDataVariant) const + 2325 (FontFastPath.cpp:201)
3   com.apple.WebCore             	0x00000001017411cd WebCore::Font::glyphDataForCharacter(int, bool, WebCore::FontDataVariant) const + 47 (FontFastPath.cpp:47)
4   com.apple.WebCore             	0x00000001017412c2 WebCore::Font::getEmphasisMarkGlyphData(WTF::AtomicString const&, WebCore::GlyphData&) const + 220 (FontFastPath.cpp:280)
5   com.apple.WebCore             	0x000000010174131c WebCore::Font::emphasisMarkHeight(WTF::AtomicString const&) const + 52 (FontFastPath.cpp:315)
6   com.apple.WebCore             	0x00000001018f4414 WebCore::InlineFlowBox::computeOverAnnotationAdjustment(int) const + 742 (InlineFlowBox.cpp:1417)
7   com.apple.WebCore             	0x00000001020757e5 WebCore::RootInlineBox::selectionTop() const + 95 (RootInlineBox.cpp:419)
8   com.apple.WebCore             	0x0000000101f6771f WebCore::RenderLineBoxList::lineIntersectsDirtyRect(WebCore::RenderBoxModelObject*, WebCore::InlineFlowBox*, WebCore::PaintInfo const&, WebCore::IntPoint const&) const + 51 (RenderLineBoxList.cpp:197)
9   com.apple.WebCore             	0x0000000101f6820e WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, WebCore::PaintInfo&, WebCore::IntPoint const&) const + 1310 (RenderLineBoxList.cpp:260)
10  com.apple.WebCore             	0x0000000101e9b443 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::IntPoint const&) + 161 (RenderBlock.cpp:2507)
11  com.apple.WebCore             	0x0000000101ea6193 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::IntPoint const&) + 477 (RenderBlock.cpp:2622)
12  com.apple.WebCore             	0x0000000101e9c276 WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::IntPoint const&) + 256 (RenderBlock.cpp:2363)
13  com.apple.WebCore             	0x0000000101f4e98a WebCore::RenderLayer::paintLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) + 2814 (RenderLayer.cpp:2807)
14  com.apple.WebCore             	0x0000000101f4f762 WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0ul>*, WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) + 156 (RenderLayer.cpp:2865)
15  com.apple.WebCore             	0x0000000101f58306 WebCore::RenderLayerBacking::paintIntoLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::GraphicsLayerPaintingPhase, WebCore::RenderObject*) + 1782 (RenderLayerBacking.cpp:1169)
16  com.apple.WebCore             	0x0000000101f58664 WebCore::RenderLayerBacking::paintContents(WebCore::GraphicsLayer const*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, WebCore::IntRect const&) + 464 (RenderLayerBacking.cpp:1218)
17  com.apple.WebCore             	0x00000001017d3bf6 WebCore::GraphicsLayer::paintGraphicsLayerContents(WebCore::GraphicsContext&, WebCore::IntRect const&) + 94 (GraphicsLayer.cpp:284)
18  com.apple.WebCore             	0x00000001017dd363 WebCore::GraphicsLayerCA::platformCALayerPaintContents(WebCore::GraphicsContext&, WebCore::IntRect const&) + 37 (GraphicsLayerCA.cpp:908)
19  com.apple.WebCore             	0x00000001022a0fa4 drawLayerContents(CGContext*, CALayer*, WebCore::PlatformCALayer*) + 501 (WebLayer.mm:79)
...

[Radar WebKit Bug Importer]

<rdar://problem/10384540>

[Simon Fraser (smfr)]

Bot shows that it's fast/inline/inline-box-adjust-position-crash2.html

[Simon Fraser (smfr)]

Created attachment 113343 [details]
Patch

[Michael Saboff]

Looks to be the right place given the backtrace.

[Simon Fraser (smfr)]

http://trac.webkit.org/changeset/99095